fix(deps): update minor dependencies #5022
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| - ready_for_review | |
| pull_request_target: | |
| branches: [main] | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| - ready_for_review | |
| push: | |
| branches: [main] | |
| issues: | |
| types: | |
| - opened | |
| - reopened | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| # ============================================================================ | |
| # PR Title Lint (Conventional Commits subset) | |
| # ============================================================================ | |
| # Squash-merge uses the PR title as the commit subject and bypasses the | |
| # local enforce-commit pre-commit commit-msg hook (bot PRs never run local | |
| # git hooks). Without a server-side check, a bot title like | |
| # "Sentinel: [HIGH] Fix ..." squash-merges with a non-conventional subject | |
| # -> PSR's commit parser silently ignores it -> no version bump, even for a | |
| # security fix. This job only surfaces a red check; it does not block | |
| # merge (no required-status-check rule), so the person merging still must | |
| # retype the squash-commit subject to start with fix:/feat: when this is red. | |
| pr-title: | |
| name: Validate PR title (Conventional Commits subset) | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: read | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| # Repo rule: only feat: and fix: (feedback_commit_prefix.md). This is | |
| # narrower than PSR's own default allowed_tags (which also treats | |
| # perf: as patch-worthy) -- we enforce the project convention here, | |
| # not just what PSR itself would accept. | |
| types: | | |
| fix | |
| feat | |
| requireScope: false | |
| subjectPattern: ^(?![A-Z]).+$ | |
| subjectPatternError: | | |
| The subject must not start with an uppercase character. | |
| lint-and-test: | |
| name: Lint & Test (${{ matrix.os }}) | |
| if: github.event_name == 'pull_request' || github.event_name == 'push' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Harden Runner | |
| if: matrix.os == 'ubuntu-latest' | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| disable-telemetry: true | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| - name: Setup Python 3.13 | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.13" | |
| - name: Install dependencies | |
| run: uv sync --group dev --no-sources | |
| - name: Run Ruff check | |
| run: uv run --no-sync ruff check . | |
| - name: Run Ruff format check | |
| run: uv run --no-sync ruff format --check . | |
| - name: Run ty type check | |
| run: uv run --no-sync ty check | |
| - name: Run tests with coverage | |
| run: uv run --no-sync pytest --tb=short --cov=mnemo_mcp --cov-report=xml | |
| - name: Upload coverage to Codecov | |
| if: github.event_name == 'push' && matrix.os == 'ubuntu-latest' | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| files: coverage.xml | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "24" | |
| - name: Install worker dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Run worker tests | |
| run: bun run test:worker | |
| docs-sync-check: | |
| name: CLAUDE.md ≡ AGENTS.md sync | |
| if: github.event_name == 'pull_request' || github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| disable-telemetry: true | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Verify CLAUDE.md and AGENTS.md mirror | |
| run: bash .pre-commit-hooks/sync-claude-agents.sh | |
| dependency-review: | |
| name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| disable-telemetry: true | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: moderate | |
| comment-summary-in-pr: always | |
| email-notify: | |
| name: Email Notification | |
| if: >- | |
| (github.event_name == 'issues' || github.event_name == 'pull_request_target') | |
| && github.actor != 'n24q02m' | |
| && github.event.sender.type != 'Bot' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| disable-telemetry: true | |
| - name: Parse SMTP credential | |
| run: | | |
| echo "SMTP_USER=${SMTP_CREDENTIAL%%:*}" >> $GITHUB_ENV | |
| echo "SMTP_PASS=${SMTP_CREDENTIAL#*:}" >> $GITHUB_ENV | |
| env: | |
| SMTP_CREDENTIAL: ${{ secrets.SMTP_CREDENTIAL }} | |
| - name: Send email notification | |
| uses: dawidd6/action-send-mail@94de994a9f6fffee200243214e17002e2920bb59 # v18 | |
| with: | |
| server_address: smtp.gmail.com | |
| server_port: 587 | |
| username: ${{ env.SMTP_USER }} | |
| password: ${{ env.SMTP_PASS }} | |
| subject: >- | |
| [${{ github.event.repository.name }}] | |
| ${{ github.event_name == 'issues' && 'Issue' || 'PR' }} | |
| #${{ github.event.issue.number || github.event.pull_request.number }}: | |
| ${{ github.event.issue.title || github.event.pull_request.title }} | |
| to: ${{ env.SMTP_USER }} | |
| from: GitHub Notify <${{ env.SMTP_USER }}> | |
| body: | | |
| ${{ github.event_name == 'issues' && 'New issue' || 'New pull request' }} in ${{ github.repository }} | |
| Title: ${{ github.event.issue.title || github.event.pull_request.title }} | |
| Author: ${{ github.actor }} | |
| URL: ${{ github.event.issue.html_url || github.event.pull_request.html_url }} | |
| Action: ${{ github.event.action }} | |
| --- | |
| ${{ github.event.issue.body || github.event.pull_request.body || 'No description provided.' }} |